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We address security of the quantum key distribution scheme based on the noisy modulation of coherent 
states and investigate how it is robust against noise in the modulation regardless of the particular technical 
implementation. As the trusted preparation noise is shown to be security breaking even for purely lossy channels, 
we reveal the essential difference between two types of trusted noise, namely sender-side preparation noise and 
receiver-side detection noise, the latter being security preserving. We consider the method of sender-side state 
purification to compensate the preparation noise and show its applicability in the realistic conditions of channel 
loss, untrusted channel excess noise, and trusted detection noise. We show that purification makes the scheme 
robust to the preparation noise (i.e., even the arbitrary noisy coherent states can in principle be used for the 
purpose of quantum key distribution). We also take into account the effect of realistic reconciliation and show 
that the purification method is still efficient in this case up to a limited value of preparation noise. 

PACS numbers: 03.67.Hk, 03.67.Dd 



I. INTRODUCTION 



Secure key distribution [1] with continuous variables yfl 
is a recent practical example of the usefulness of quantum 
properties exhibited by coherent states generated with ordi- 
nary laser systems. The pure coherent states were surpris- 
ingly found to be the sufficient resource to distribute a secret 
key, even through a strongly attenuating channel JH-0], while 
the inefficiency and electronic noise of a homodyne detector 
in a trusted receiver station does not break security of the key 
distribution [7]. Recently, security analysis of excess noise in 
the channel and detector was discussed in |8y; moreover, the 
noise at the remote side was shown to be useful for the scheme 
security |9j. However, it was also recently shown that excess 
noise in trusted state preparation can break the security even 
for a purely lossy channel and ideal homodyne detector lloll . 
To eliminate this security break, an optimized purification of 
the prepared noisy coherent states in the trusted sender station 
was proposed. Interestingly, it was shown that secure com- 
munication through any purely lossy channel is possible for 
arbitrary noisy coherent states, assuming ideal homodyne de- 
tection 1 10]. From this follows that even a noisy coherent state 
can be a useful quantum resource for secure key distribution 
in the perfect experimental conditions of pure channel loss. 
Still an open question is how generally valid is this result for 
an imperfect homodyne detector, with remaining excess noise 
in the channel and realistic key reconciliation. 

In this article, we discuss security of the continuous- 
variable (CV) quantum key distribution (QKD) with noisy co- 
herent states through a lossy and noisy channel. The prepa- 
ration noise is due to the imperfect modulation, which was 
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shown to be destructive for the security of the scheme. We 
reveal the fundamental difference between various types of 
trusted noise and show the possibility to establish the secure 
key transmission with noisy coherent states upon a high level 
of preparation noise using the local state manipulations in the 
presence of either trusted detection noise or untrusted channel 
noise. We also investigate the limits of high modulation vari- 
ance and show that in this case we can practically eliminate 
the negative effect of the preparation noise using optimal pu- 
rification. In addition, we show that the positive purification 
effect is present also upon limited reconciliation efficiency. 

The article is structured as follows: in Sec. [II] we briefly 
recall the QKD with noisy coherent states and mention the 
effect of the purely lossy channel; in Sec. |III]we add detection 
noise on the trusted remote party side; in Sec. ||V]we consider 
untrusted channel noise; in Sec. |V]we take into account the 
effect of the realistic error correction with limited efficiency; 
and then we finish the article with some concluding remarks. 



II. COHERENT STATES PROTOCOL 

CV QKD with coherent states is based on the Gaussian 
modulation of the states produced by a laser in such a way 
that their mixture constitutes a thermal state centered in an 
origin of phase space and characterized by a source variance 
V = 1 + a, where a is the modulation variance. Such a 
setup is referred to as the prepare and measure (P&M) as 
one of the trusted parties (Alice) for each next key bit applies 
modulation to the coherent states, generating them centered at 
some two Gaussian-distributed values of quadratures (Fig. [TJ. 
The prepared state travels though a quantum channel to the re- 
mote trusted party (Bob), which performs the homodyne mea- 
surement of a randomly selected quadrature and stores the re- 
sult. Lately, as the sufficient number of preparation and mea- 
surement events is carried out, the parties perform key sift- 
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ing when Bob, using a classical channel, reveals which of two 
quadratures he was measuring for each bit and Alice keeps the 
corresponding bit value, such a scheme being named reverse 
reconciliation yfl. From the obtained classically correlated 
data, if they they are correlated enough (which is checked by 
comparison of the randomly selected subsets), trusted parties 
can distill the secure cryptographic key. Physically, the ex- 
cess noise arises mainly in the imperfect optical modulator so 
that each coherent state has the variance 1 + AV, where AV 
is the preparation noise. Besides preparation noise, another 
main source of imperfection is the quantum channel, which 
has nonunit transmittivity 77, thus suppressing the signal with 
losses and adding excess noise 77 to the signal modulation. 
Also imperfect detection at Bob's side is assumed, as his ho- 
modyne detector has some nonunit efficiency and the excess 
electronic noise; we consider imperfect detection as adding 
excess detection noise \. Here, for the trusted detector we 
treat loss and noise in the detection jointly, as the output of 
the detector is typically classically amplified; thus the detec- 
tor can be purely noisy so that \ is the total additive noise of 
the detector. At that, the state preparation is assumed to be 
completely secure (i.e., no attack of an eavesdropper in the 
sender station is allowed and no side signal leaves the sta- 
tion). Also, the receiver station is trusted, which means that 
no information is leaking to a potential eavesdropper, whereas 
the quantum channel is untrusted as it is out of control of the 
trusted parties. 

It already is well known that untrusted channel noise is lim- 
iting the security of CV QKD, whereas trusted detection noise 
is not contributing to the the knowledge of Eve and is just 
quantitatively reducing the key rate fl. At the same time, it 
was recently shown that the preparation noise, although be- 
ing also trusted, is breaking the security of the CV QKD 11011 . 
Thus, in this article we stress out the essential difference be- 
tween two types of trusted noise, namely preparation and de- 
tection, in their effect on the CV QKD security and study the 
method to compensate the negative effect of trusted prepa- 
ration noise by applying state purification. In our theoret- 
ical analysis, we model the CV QKD coherent states-based 
scheme in order to estimate its security, taking realistic values 
of the parameters of the scheme. In particular, we suppose that 
the quantum channel has low transmittance r\ G (0.01, 0.1), 
which corresponds to long-distance optical fibers; the source 
variance V is mostly taken within the range V £ (10, 100), 
which well corresponds to recent experiments in CV QKD, 
where the source variance reached approximately 20 J8D or 
40 (3J shot-noise units. The typical values of the homodyne 
detector electonic noise in the mentioned experiments were 
0.041 and 0.33, respectively, but the limited detection effi- 
ciency makes the overall homodyne detection noise higher. 

At the same time, it is hard to assess the possible values 
of the preparation noise, as the sources of this noise may be 
essentially different; it can be either imperfect modulation of 
a shot-noise limited coherent source or the increased variance 
of a laser, which is used to produce the exact state, displaced 
according to a next bit value. Besides, the values of such 
noise were not discussed in experimental CV QKD as this 
noise is difficult to estimate and calibrate |8j]. Hence all the 



noise in the receiving station was considered to be the impact 
of Eve and the sources were usually assumed as ideal, focus- 
ing on other possible imperfections. However, the simplest 
sources for a classical coherent optical communication link 
are cheap laser diodes together with the usual low-frequency 
integrated amplitude and phase modulators lfl2tl . While such a 
source still has enough temporal coherence to build the coher- 
ent communication link, its intensity and phase noise added 
at the lower modulation frequencies makes the source to be 
not shot-noise limited, exhibiting additional excess noise 11311 . 
For the classical coherent communication, this is not a serious 
problem, and these issues can be considered to be just techni- 
cal, but it appears to be essential for QKD, as the preparation 
noise can quickly lead to a security break. Hence, we propose 
to distinguish between trusted preparation noise and the rest of 
the noise and show that this may improve the applicability of 
C V QKD as we can compensate security -breaking preparation 
noise. Note, that in the case of the discrete-variable coding the 
mixed signal states were considered already in ifTTll . 

It is worth mentioning, that the method of sender-side atten- 
uation, which we propose and investigate in this article in or- 
der to purify the states and make CV QKD more robust to the 
preparation noise, is most likely just one of the possible ways 
to reduce the negative effect of the state preparation noise. Yet 
we propose it as the simplest method to purify the states by us- 
ing just a linear optical device, the beam-splitter, in case the 
noisy source is given and cannot be otherwise improved. In 
addition, by introducing attenuation T, we can clearly show 
the effect analytically and optimize it as well as estimate the 
limitations, imposed on the purification method by the recon- 
ciliation efficiency. 

As a matter of fact, the attenuation of the signal on the 
trusted source side was already applied in [8] without the 
analysis of the impact. Its effect is actually twofold: to pu- 
rify the noisy states by suppressing the noise and to opti- 
mize the signal-to-noise ratio for the given reconciliation ef- 
ficiency. Still, the purifying effect was not theoretically ana- 
lyzed. Moreover, the attenuation of laser diodes was proposed 
by decreasing their power |7], but this method is not appli- 
cable for the case, when modulation is performed directly in 
the laser, not by a standalone modulator. Also, the feedback 
systems were applied yl |8[] to control the level of modulation 
and they can be used to reduce the noise, but as their effect is 
nonlinear, it is not considered in this article. 

For the security analysis, it is assumed that Eve couples 
signal pulses to her ancillary states and stores them in a quan- 
tum memory. Then she can perform either an individual at- 
tack after the key sifting procedure, when she measures her 
ancillary states individually, or a collective attack during the 
key distillation, when she applies the optimal collective mea- 
surement on the stored ancillary states. We limit our study of 
security of the scheme by Gaussian collective attacks as they 
were shown to be optimal [6] and keep to the the recent proof, 
that, similar to the case of discrete-variable QKD, the pro- 
tocol is secure against the most general attacks, if it is secure 
against the collective ones [ 14]. For individual attacks, in case 
of reverse reconciliation, the security analysis is based on the 
fact that maximum information available to Eve is bounded 



3 




+AV y 

Trusted preparation 



Trusted detection 



FIG. 1: Continuous-variables quantum key distribution scheme 
based on the noisy coherent states: Laser beam is modulated to en- 
code information in modulator M producing coherent states with su- 
perposed additive phase-insensitive noise AV. It passes through a 
variable attenuator with transmittance T (with a second port in vac- 
uum mode C) followed by the channel described by excess noise e 
and channel transmittivity 77 toward Bob's homodyne detector with 
additive noise \- Inlay: equivalent model of Alice noisy state prepa- 
ration based on the entangled signal source (modes A, B) of variance 
V and entangled noise source (modes F, G) of variance A V, coupled 
to signal mode, Alice performing heterodyne measurement on mode 
B; rest of the scheme is the same as for coherent state modulation. 



by the classical (Shannon) mutual information, characterizing 
her knowledge of Bob's data, while in the case of collective 
attacks Eve is possessing the quantum (von Neumann) infor- 
mation on Bob's measurement results, which is limited by the 
Holevo bound; in all cases, the criterion for security is formu- 
lated as the exceeding of mutual information between Alice 
and Bob over the information available to Eve on Bob's data; 
under this condition the secure key can be distilled by the stan- 
dard procedures. Thus, for the collective attack scenario and 
one-way classical postprocessing, there is always a key distil- 
lation protocol generating secure key with minimal rate 
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where Iab is Shannon mutual information from data ob- 
tained by Alice and Bob, xbe is the Holevo information 
quantity between receiver B and potential eavesdropper Eve 
IU5I1 . The Holevo quantity can be written as xbe = Se — 
J P(B)SE\BdB, where Se is von Neumann entropy of the 
eavesdropper's state pe Ja]. The quantity Se\b is the von 
Neumann entropy of the eavesdropper state Pe\b conditioned 
by the receiver measurement result B, and P(B) is the dis- 
tribution of the measured results. If I > 0, then information 
shared by Alice and Bob is larger than information accessi- 
ble to an eavesdropper which is performing collective attacks. 
Then optimal distillation procedure can generate a secure key 
between trusted parties. 

A weaker condition is for security against only the indi- 
vidual attacks. In this case, the lower bound on secure key 
rate is given li = Iab — I be, where I be is Shannon mu- 
tual information between the eavesdropper and the receiver, 
if the eavesdropper applies an optimal strategy. Remarkably, 
for ideal coherent-state preparation without any excess noise, 
it is always possible to achieve p nax = — log 2 (l — f])/2 > 



for an arbitrary lossy channel (but without excess noise) with 
?7 > and for arbitrary modulation variance a > JH]. 

While we consider the security of the scheme for collective 
attacks, we will use the individual attack case to estimate the 
regions of parameters, where the scheme already becomes in- 
secure for any attacks, because insecurity against individual 
attacks automatically means insecurity against the collective, 
as the latter are more effective. Furthermore, the individual 
attack case enables us to analytically show the effect of state 
purification as well as constitute the limits to which collective 
attacks tend in the high modulation regime. 

So, we investigate the security of the scheme based on the 
noisy coherent states in different realistic conditions. The sit- 
uation, when only the state preparation noise is present in 
the CV QKD based on the coherent states and the quantum 
channel is purely lossy, was already addressed in [ 10]. It was 
shown that the preparation noise is strongly destructive for se- 
curity of the scheme, but the purification on the side of the 
trusted source can provide the possibility to establish secure 
key distribution upon any value of the preparation noise, and 
that security is guaranteed against both individual and collec- 
tive attacks. Although seeming contradictory at first glance, 
this result can be clearly explained from the physical consid- 
erations. As the state coherence is preserved upon any atten- 
uation, by suppressing the noisy coherent state we suppress 
the noise, but the state coherence remains, so that while the 
intensity becomes lower and the key rate decreases, the state 
becomes pure enough to provide the security of the key distri- 
bution, which without purification could not be possible. The 
earlier work provided the proof of principle for suppressing 
preparation noise with purification, while in this article we 
perform the feasibility check of the method in the realistic 
conditions of trusted detection noise, untrusted channel noise, 
and imperfect key reconciliation. 

Generally we investigate whether a noisy source can be 
used for a CV coherent states-based QKD given that the 
source cannot be replaced with a better one. While the exact 
level of preparation noise is the question of cost and complex- 
ity of the state preparation equipment, in this article we rather 
generally discuss the impact of the preparation noise on the 
QKD security, than refer to a specific experimental arrange- 
ment. In this sense, our work is a step from perfect laboratory 
conditions toward the realistic CV QKD, based on the afford- 
able signal sources. 



III. NOISELESS CHANNEL AND TRUSTED DETECTION 
NOISE 

First we generalize the result presented in ifloll that is valid 
for the lossy channel and ideal homodyne detector. Keep- 
ing the noiseless channel in mind, we assume a realistic lossy 
and noisy trusted homodyne detector. This represents an op- 
timistic scenario of realistic experimental setup, taking into 
account the minimal impact of natural channel background 
noise into narrow-band homodyne detection. 

First we calculate the impact of noise on the security against 
individual attacks to estimate the insecurity region. As we per- 
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form the calculations in the equivalent entangled-based source 
setup 1 8], the overall expression for the lower bound on the 
key rate, which is secure against individual attacks using the 
reverse reconciliation, is ytl 
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where V B \ E — Vb 
relevant conditional variances 
Va appears from the heterodyne measurement on Alice's side. 
In our case, the variances are Va = V, Vb = f](V + AV) + 
1 — V + X an d Ve = (1 — v)(V + AV) + r\ and the mode 
correlations are Cbe = -r?)(l - V - AV) whereas 

Cab — \fri(y 2 — 1)- Detection noise x, being out of control 
by the eavesdropper, is not involved in the correlation Cbe', 
hence, it does not break the security but only lowers the key 
rate. The conditional variances are V b \a m = 1 + ?;AV + x 
and 
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then from the explicit expression §2^ for the lower bound on 
key rate in this case we can derive the security constraint on 
the level of the preparation noise: 
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which does not depend on the detection noise, added on the 
remote receiving side. 

In the limit of arbitrary large source variance (i.e., arbitrary 
high modulation), this constraint turns to 
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which means that for strongly attenuating channels r\ « 
1, even if the modulation is arbitrarily high, the preparation 
noise should not exceed one shot noise unit, while this con- 
dition becomes more restrictive for the realistic cases of finite 
modulation. 

In the case of collective attacks, as mentioned, Eve's infor- 
mation on the key is limited by the Holevo quantity. Since 
we are considering a purely attenuating channel, we substi- 
tute it by a beam splitter with the transmittance equivalent 
to the channel transmittivity r\. We perform the straight- 
forward calculations of the Holevo quantity xbe = Se — 
J P(B)S B \BdB, bounding Eve's quantum information from 
a state going from the beam splitter to Eve. Since we are 
working with Gaussian states, entropy S b \b does not de- 
pend on the Bob's measurement result and we can simply use 
Xbe = Se — S B \ B - Using the expression for von Neumann 
entropies [16], the Holevo quantity is calculated from 
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FIG. 2: The effect of trusted detection noise \ an d trusted preparation 
noise AV on the secret key in the case of no purification. Security 
against collective attacks is considered, source variance V = 20, and 
channel transmittivity r\ — 0.01. 



where G(x) = (x + 1) log(x+ 1) — x log x, \\ is the symplec- 
tic eigenvalue of Eve's mode covariance matrix -fE — VeI, m 
fact Ai = ^/DeVjE and A 2 is the symplectic eigenvalue of the 
covariance matrix j E B characterizing the state of Eve's mode 



after Bob's projective measurement: 
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where -f B — V B I is the covariance matrix of Bob's mode, 
<j B e characterizes correlation between Bob's and Eve's 
modes, MP stands for Moore Penrose inverse of a matrix (also 
known as pseudoinverse) and 
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Finally, the mutual information Iab is calculated using Shan- 
non entropies as 
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The explicit expression for the key rate is obtainable ana- 
lytically, but it is too lengthly. However, similarly to the case 
of individual attacks, the security of the scheme is limited by 
the preparation noise and the boundary for collective attacks is 
close to that of the individual attacks (01, while in the limit of 
arbitrary high modulation it exactly coincides with @. The 
effect of the preparation noise in comparison to the effect 
of the trusted detection noise in case of collective attacks is 
shown in Fig. |2]for the lossy channel with rj = 0.01 and re- 
alistic source variance V = 20. One may see, that despite 
the fact, that both kinds of noise are trusted, the preparation 
noise is security breaking, unlike the detection noise, which 
is only quantitatively reducing the key rate - the effect, which 
we observed above for the individual attacks case. 

Now let us assume that purifying attenuation is applied to 
the signal states prior to sending them through the quantum 
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channel. By supposing the attenuator transmittivity is T, we 
can see its positive affect already for individual attacks, as the 
lower bound on the key rate in this case is 
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and from this expression it is clear that attenuation T is sup- 
pressing the preparation noise AV. If the modulation variance 
is arbitrary high, this effect is even more evident, as the key 
rate turns to 
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and can be made arbitrary high by purification. 

For the finite V, if we take the derivative of the key rate ( fTOb 
by purifying attenuation T in the point T = 0, we obtain 
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which is always positive as V > 1. This means that close 
to T = there is always some T > that is sufficient to 
provide with the secure key rate because at point T = 0, the 
key rate is equal to 0. From the given expressions it is evident 
that detection noise, being not under the control of an eaves- 
dropper, only decreases the key rate but does not destroy the 
transmission, even for finite source variance V, the detection 
noise x does not change the security bounds, whereas prepara- 
tion noise AV plays crucial role. It is also worth mentioning 
that while secure key transmission is possible for arbitrarily 
high preparation noise upon arbitrary strong purification, for 
the given parameters, there always exists an optimal purifica- 
tion level, which maximizes the secure key rate. We skip the 
corresponding lengthly equations here, but in the further ex- 
position we calculate the maximal key rate values in various 
conditions. 

If the optimal purification is applied on the noisy signal and 
the modulation is extremely intense so that the source variance 
V — > oo, then the expression for the bound on the key rate for 
individual attacks dTOb analytically turns to the expression for 
the case when the preparation is pure, i.e. AV = and the 
modulation is infinitely high: 
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which means that by combining optimal purification with 
large modulation variance we can completely compensate the 




FIG. 3: The effect of trusted detection noise \ an d trusted prepa- 
ration noise AV' on the secret key if the optimal purification is ap- 
plied. Security against collective attacks is considered, source vari- 
ance V — 20, and channel transmittivity rj = 0.01. 



negative effect of preparation noise and achieve the values of 
key rate corresponding to the generation of pure states. Fur- 
thermore we will obtain a similar result in other cases. 

In the case of collective attacks, similarly to the individual 
attacks, we can calculate the derivative of the key rate by pu- 
rifying attenuation T and evaluate it in the limit of T — >• 0, 
arriving at the same result as (fT3l for individual attacks, prov- 
ing that for finite modulation variance a, we can always find 
some T close to 0, which will provide secure transmission for 
any preparation noise AV as I c |t^o = 0. This result was 
also confirmed numerically by estimation of the maximal key 
rate secure against collective attacks upon optimal attenuator 
setting for given preparation noise and channel loss level. The 
optimized key rate versus preparation and detection noise is 
presented in Fig. [3] It is evident from the plot that by ap- 
plying optimal purification to the noisy states we can turn the 
negative security-breaking effect of the preparation noise to 
the same as that of the detection noise, which is only reducing 
the key rate, but not turning it to zero. 

In the limiting case of infinitely high modulation (i.e., 
source variance V — > oo), the expressions for key rates and 
preparation noise thresholds are the same as for individual at- 
tacks, namely ( II U121 i. which means that by combining opti- 
mal attenuation and arbitrary high modulation, we can com- 
pletely remove the negative effect of the preparation noise. 



IV. CHANNEL NOISE AND UNTRUSTED DETECTION 
NOISE 

While state purification was shown to be effective in case 
when trusted noise is present in the system, let us estimate the 
applicability of the method in the worst-case scenario, con- 
sidering that noise, observable in the receiving station, is not 
trusted. This can be channel background noise in the case of 
broad-band detectors, untrusted detection noise or the influ- 
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ence of Eve, but as channel is the only untrusted part of our 
scheme, we refer to this noise as to the channel one. 

Let us consider excess noise e, which is out of control of 
trusted parties. In the case of individual attacks, we use the 
"entangling doner" scheme [3], which allows Eve to perform 
optimal eavesdropping by substituting the channel of loss rj 
and excess noise e with her apparatus. The optimality of the 
doner attack is due to the fact that it enables Eve to reach 
the limit of her knowledge on Bob's data, described by the 
Heisenberg uncertainty principle, with the statement being 
valid under the assumptions that the used states are Gaus- 
sian and Eve knows the parameters of the channel, which well 
holds in our case. The attack uses pure two-mode squeezed 
vacuum state having local variance N; one mode is reflected 
to Bob's mode through the beam splitter with reflectivity 1 —r\, 
whereas the transmitted part is kept by Eve. The second mode 
from the two-mode squeezed vacuum state is purely in the 
hands of Eve. Eve is fixing N in order to satisfy N = 1 + 
this way emulating the channel by her apparatus. She can 
store both of her modes in quantum memories and measure 
the appropriate quadratures of both modes in order to decrease 
the noise added to the measured part of the signal mode upon 
eavesdropping. 

If Eve's modes variances before interaction with the signal 
are V E o = V E o = N and Bob's mode is V Bo = T(V+AV) + 
1 — T, then after interaction between modes B and Ei their 
variances are V E = *?Vb + 1 — V + V e ar, d Vei = f)VE° + 
(1 — t))Vb , while correlation between the modes is Cbe x — 
\J r\{\ — rj)(V E o — Vb ). By calculating conditional variance 
as Vb\E\ — Vb — C BEi /V El and taking into account that 
after Eve's measurement on mode E2 the conditional variance 
of measurement on mode E\ becomes Veae-i — 1/iV, we 
obtain the expression for conditional variance of Eve's results 
on Bob's measurement results, which is 



However, we may estimate the region of channel loss in 
which the purification can provide security for the given noise 
levels. As the channel excess noise can be hardly detected by 
trusted parties, in the entanglement doner scenario, we take 
Eve's Einstein-Podolsky-Rosen (EPR) source variance N as 
the parameter, which is independent on 77. Within this ap- 
proach we may estimate the bound on r\ which restricts the 
security of key distribution for the given noise levels using 
the condition for optimal purification T opt < 1, this bound on 
security can be expressed as 
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it can be compared to the similar bound on ?/, restricting the 
security of the key upon no purification, T = 1 . We skip the 
lengthy expression for the latter bound, but the calculations 
show that the region ( fT8l is no larger than the similar region 
for no trusted side attenuation, i.e. purification provides secu- 
rity of the key for any Ay in the same region of parameters, 
where the security was provided for no purification and no 
preparation noise. 

The optimal purification, which maximizes the secure key 
rate upon given parameters can be expressed as 



Topt — 



1 
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In the limit of infinitely high modulation (i.e., source vari- 
ance V —> 00), the bound on the key rate turns to 
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whereas Alice's uncertainty from the measured results is 



V b \ A m = 1 + r/TAV + rje. 
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while the threshold on the preparation noise involves chan- 
nel noise, which is additionally limiting the tolerable prepara- 
tion noise: 



From the expression ( fTOb we can explicitly obtain the lower 
bound on the key rate in case of the untrusted channel noise: 



•log 2 



- 1 



1 



T(V+AV) + 1-T 

-llog 2 (l + Tr)AV + er]), (17) 



The derivative of the key rate by T in the point T = is 
again always positive with 4 ^ , but as the key rate 
at T = is equal to only when e = 0, being negative at 
any other e > 0, the security upon channel noise is no longer 
guaranteed only by purification. 



AVi. 



1 -e 



T(l — 77 + rje) 



e 

T' 



(21) 



However, if the optimal purification ( fT9b is applied in this 
case, the expression for the secure key rate turns to the one for 
the case of infinite modulation and no preparation noise: 



|T=T op( 



= 77 lo S2 



1 



rje + 1 — 7/ 
-log 2 (l + 77e) = Iilv^, 



(22) 



which means that the combination of optimal purification 
and sufficiently large modulation variance can completely 
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eliminate the negative effect of the preparation noise. Still, 
for the limited source variance, the security can be provided 
for any given preparation noise within the limited range of 
noise introduced by an eavesdropper as described by ([T8l >. 

In the case of collective attacks performed by an eavesdrop- 
per we can no longer use direct calculations of the Holevo 
quantity used in the previous section. Rather, we assume that 
Eve can purify the complete state shared among all the parties. 
In order to perform calculations for this case we must switch 
to the entangled-based scheme, which was shown to be equiv- 
alent to the prepare-and-measure one [8] and take into account 
all the trusted modes in Alice's station. Similarly, we will as- 
sume the worst-case detection scenario, that all the noise and 
loss in the Bob's station is untrusted. 

In the entanglement-based scheme, the entanglement is 
generated in the source EPR : V by mixing two pure or- 
thogonally squeezed states with the squeezing variance Vg 
at a balanced beam splitter producing two entangled modes 
A and B. The mode A in the thermal state of variance V — 
(Vs + Vg l )/2 is measured by Alice simultaneously in both 
quadratures by the heterodyne detector, while mode B is cou- 
pled to the noise mode G from the similar entangled source 
EPR : AVb of variance AVq, emulating preparation noise 
in modulator (see Fig. [T] inlay). To emulate the additive 
noise with noise variance AV, the coupling between B and 
G is strongly asymmetrical, with almost unit transmittivity 
Tjv ~ 1. This setup corresponds to the preparation noise of 
variance AV = (1 - T N )AV . 

Now the state of ABCFG is pure in the absence of chan- 
nel noise and we can use the fact that Eve purifies this state so 
that von Neumann entropy Se = Sabcfg- Then, after Bob's 
measurement the system ACFG is pure and the conditional 
entropy Sb\b = Sacfg\b- Thus, the Holevo quantity be- 
comes xbe — Sabcfg — Sac fg\b- We perform calculation 
of these values similarly to the case of individual attacks, by 
obtaining symplectic eigenvalues of the five-mode covariance 
matrix ABCFG and four- mode matrix ACFG\B, which can 
be done purely numerically. As a result, we get the method 
allowing us to perform calculations of the lower bound of the 
key rate upon any conditions in the presence of both prepa- 
ration and channel excess noise and we investigate the effect 
of purification on the applicability of the scheme. Moreover, 
we have numerically confirmed that in the absence of channel 
noise this method, based on the state purification, is equiva- 
lent to the method based on Eve's mode calculation, which 
was used in the previous section. 

Like in the individual attacks scenario, in the case of the 
collective attacks, security is now limited by both preparation 
and channel excess noise. We calculated the maximal tolera- 
ble channel excess noise as the function of preparation noise 
both for optimal purification and no purification on Alice's 
side; the results are given in Fig. |4]for typical source variance 
of V = 10 and for almost ideal case of extremely large source 
variance V = 10 5 . It was checked numerically and can be 
seen from the graphs that, similarly to the case of individual 
attacks, when the purification is optimized, the transmission 
is now possible upon arbitrarly high preparation noise if the 
channel itself was not destructive, and the scheme is not be- 




AV 



FIG. 4: Maximal tolerable channel excess noise versus given prepa- 
ration noise for no Alice-side purification (dashed line) and with op- 
timal attenuator setting (solid line), source variance V = 10 (lower 
lines) and V = 10 (upper lines), and channel loss r\ = 0.01 




0.001 
0.00 



0.10° 



FIG. 5: Maximal key rate as the function of channel excess noise e 
and preparation noise AV, source variance V = 10, and channel 
loss r\ = 0.01 



coming more sensitive to the channel noise than without pu- 
rification. Also for large source variance V the dependence 
of maximal tolerable excess noise on given state preparation 
noise approaches saturation, starting to be very slow. 

Thus, we need to increase source variance V (by increasing 
modulation variance a) in order to weaken the dependence of 
key rate on the preparation noise AV. However, for small 
source variance V —¥ 1, the dependence on preparation noise 
is qualitatively the same, just the scheme quickly becomes 
sensitive to channel noise. 

For the realistic cases, in order to perform the qualitative 
comparison, the maximal key rate was calculated as the func- 
tion of preparation noise and channel excess noise and is given 
in Fig. Hfor V = 10 and in Fig. [6]for V = 100. It is evi- 
dent from the graph, that for relatively small channel noise the 
security of the scheme can be provided upon any preparation 
noise level, while as the channel noise increases, the security 
is not guaranteed anymore. 
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FIG. 6: Maximal key rate as the function of channel excess noise e 
and preparation noise AV, source variance V = 100, and channel 
loss r\ = 0.01 




FIG. 7: The region of parameters for which the security is guaranteed 
for source variance V = 100 



The region of parameters for which the security is guaran- 
teed is plotted for source variance V — 100 at Fig. [7] and 
one can see that over the broad values of channel loss 77 and 
channel noise e, the security is guaranteed for any preparation 
noise AV^, while dependence on AV upon its high values be- 
comes more linear and flat, approaching the horizontal surface 
for extremely high source varance V — > oo. 

Let us now consider the relatively simple case of no prepa- 
ration noise (i.e., AV = 0). The explicit expressions for the 
key rate even in this case are lengthy [although analytically 
obtainable through the symplectic eigenvalues of matrices AB 
and A\xb and extended expression ©]. We are interested in 
extremely lossy channels, so we perform a series expansion of 
the key rate with respect to source variance V around infinity 
and to channel loss 77 around zero. Such expansion up to the 
first order has the form 



while for V — > 00 the approximate normalized expression 
for the key rate turns to 

I c \y V _^ ~ 0.721??- 1.22l77e + 0.72l77e logr7e. (24) 

Now we perform the analytical least-squares fit of the nu- 
merical data fl7h . obtained for the optimal purification when 
preparation noise is present: 

Zclyl^f ~ 0.72277 - 1.237?7e + 0.73l77elog77e. (25) 

which very well fits the numerical data and at the same 
time is close to the approximate expression for the key rate 
in the case of no preparation noise (1241) , We also performed 
a comparison between a numerically calculated maximized 
key rate upon optimal purification, high source variance V — 
10 5 , preparation noise AV^ € (0, 5) and the analytically 
obtained values of the key rate upon the same source vari- 
ance, no purification and no preparation noise Ay = in 
the region of loss 77 g (0.01,0.1) and channel noise e g 
(0.01, 0.1). The standard (root-mean-square) deviation of the 
maximized key from the analytical key rate in case of pure co- 
herent states is approximately 6 x 10~ 5 , which is calculated 

as s = yj t^t £„ S I fa- £ ) " Ic I vSoT fa' AF ' £ )) 2 ' 

where n = 10 3 is the number of points (77, AV, e) taken within 
the regions of parameters [ 18]. The average relative deviation, 
being the ratio of the standard deviation to the average value of 
the key rate for pure states I c | v _ w5 (t], e) f=s 0.026, is around 
2%. This divergence can be made even smaller upon further 
increase of source variance; for example, at V = 10 6 it al- 
ready becomes less than 1%. 

This way we claim that by combination of optimal purifi- 
cation and extremely large modulation variance the key rate 
for collective attacks can reach the values as for the case of no 
preparation noise. Thus, with the optimal purification upon 
high modulation variance we can completely eliminate prepa- 
ration noise for both types of attacks, which in the absence of 
purification would otherwise be destructive for the key trans- 
mission. 



V. REALISTIC RECONCILIATION 

In previous sections we calculated the lower bound on the 
secure key rate assuming that the classical postprocessing al- 
gorithms, which are aimed at deriving the secure key from 
the raw key, obtained by Alice and Bob, are absolutely effi- 
cient and do not reduce the key length. In practice, though the 
realistic error correction, which is also referred to as key rec- 
onciliation [19], has limited efficiency and is being done by 
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the cost of the key length, thus decreasing the overall secure 
key rate. The negative effect of the realistic key reconciliation 
was shown to essentially limit the applicability of the secure 
key distribution with binary modulation of coherent states, es- 
pecially in case of the reverse reconciliation H2Qfl . The similar 
effect is observed in the case of continuous-variables coding; 
thus, we must investigate whether the state purification is still 
efficient against the preparation noise if the error correction 
has limited efficiency. 

In practical CV QKD the influence of the realistic key rec- 
onciliation is quantitatively characterized by the efficiency /3, 
which is reducing the mutual information, available to Alice 
and Bob and stands for the fraction of the data, discarded in 
the process of error correction. Thus, in the case of collective 
attacks the efficient lower bound on the secure key is given by 




leff ~ filAB — XBE 



(26) 



Reconciliation effectiveness (3 is a function of the signal-to- 
noise ratio (SNR), but it also depends on the algorithm, being 
used for the reconciliation and on the computational power, 
which is available for the trusted parties. Generally, the lower 
the SNR, the stronger the negative impact of the inefficient 
error correction, although for a given j3, there is always some 
optimal value of SNR (i.e., of the modulation, applied to the 
coherent signal [8] if other parameters are fixed). So, as recon- 
ciliation efficiency f3 depends on the particular technical pa- 
rameters, we do not use the explicit function describing the 
dependence of (3 on SNR in our theoretical analysis. Instead 
we assume that the dependence of /? on SNR is unknown, so 
we must keep both as the independent parameters and esti- 
mate how tolerable is the CV QKD to the preparation noise 
upon realistic reconciliation when we perform state purifica- 
tion by attenuating the signal or when the purification is not 
applied. As a result, we describe the area of values of SNR 
and fj, where the method gives positive effect. Then in any 
particular case, when the dependence of f3 on SNR is known, 
it can be easily found, whether given reconciliation efficiency 
allows improvement by the proposed purification method. 

Let us consider the purely lossy channel, as the effects of 
both preparation noise and inefficient reconciliation are sig- 
nificant already in this case. In the previous sections the lower 
bound on the key rate / was the function I(V, AV, rj, T) of 
source variance, preparation noise, channel loss and trusted- 
side attenuation T. At the same time, SNR E, being the ratio 
of the signal variance to the overall excess noise variance at 
the channel output is also the function E(V, AV, 77, T) of the 
same parameters: 



E = 



Ty(V-l) 
1 + TrjAV 



(27) 



So, in order to describe the security region in terms of the 
preparation noise, taking into account the inefficient reconcil- 
iation, when the purification is absent i.e. T = 1, we perform 
the transition V —> V(E, AV, 77), recalculate the lower bound 



FIG. 8: Threshold on the preparation noise versus reconciliation ef- 
ficiency ft and SNR for any source variance V and typical channel 
loss rj = 0.1 when no trusted-side purification is applied (T = 1) 



on the key rate in new terms as I e f j (E, A V, V> P)> taking into 
account d26l i and can estimate the threshold values of prepara- 
tion noise AV ma x, which turn this lower bound to zero. The 
threshold is presented graphically as the three-dimensional 
(3D) plot versus reconciliation efficiency f3 and SNR for typ- 
ical channel loss r\ — 0.1 in Fig. [8] note that it is independent 
of source variance V, which is given by the value of SNR. 

Now let us suppose we plug in the attenuation at the trusted 
side, which is aimed at the purification of the signal states. 
Then SNR puts the constraint on attenuation T as all other pa- 
rameters are given and we can express T as T(E, V, AV, rj). 
Similarly, we reculaculate the lower bound on the secure key 
as I e f f (E, V, A V, V> P) anc l estimate the threshold on prepara- 
tion noise AV, when the attenuation T, unlike in the previous 
sections, is no more optimized, but is explicitly given by the 
SNR and other parameters. In Fig. [9] we present the results 
as the 3D plot of the security region, describing the maximal 
tolerable preparation noise AV max versus reconciliation ef- 
ficiency f3 and SNR, realistic source variance V = 20 and 
typical channel loss rj = 0.1. 

Any practical scheme has its own dependence of reconcil- 
iation efficiency on SNR, which is related to the intristic pa- 
rameters of the scheme, which can be graphically described 
by a curve in the j3, SNR plain. Thus, in order to estimate 
the tolerance of the particular scheme to the preparation noise 
and the effectiveness of state purification, one should project 
this curve on surfaces at Figs. [8] and [9] respectively. Never- 
theless, in the general case, it is evident from both plots, that 
the preparation noise is significantly limiting the securirty of 
the scheme in the large region of SNR and reconciliation ef- 
ficiency j3. At the same time, the applicable purification on 
the trusted side can essentially improve the tolerance to the 
preparation noise, not reducing the applicability area in terms 
of SNR and j3. Interestingly, this area is even increased by 
purification, giving a high threshold on tolerable preparation 
noise for low SNR and f3, although the key rate in this area is 
very low and can be thus drastically affected by other practical 
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FIG. 9: Threshold on the preparation noise versus reconciliation ef- 
ficiency P and SNR for realistic source variance V = 20 and typical 
channel loss r\ = 0.1 when the states are purified by attenuation T; 
values of AV ma x are bounded by 10 for the convenience of graphical 
representation. 



imperfections. 

VI. CONCLUSIONS 

We have investigated the influence of the noisy modula- 
tion on the security of the quantum key distribution scheme 



based on the coherent states upon realistic conditions of chan- 
nel loss and detection (trusted) or channel (untrusted) excess 
noise. While the preparation noise was shown to be destruc- 
tive to secure transmission, which reveals an essential differ- 
ence between two types of trusted noise, we investigate the 
possibility of suppressing the preparation noise. It is shown 
that optimal purification on the trusted sender side drastically 
increases the security region in terms of the tolerable prepara- 
tion noise if the channel itself is not security breaking. Thus, 
noisy coherent states are as useful for the secure key distribu- 
tion as the pure coherent states. In the case of the high source 
variance, the optimal purification is shown to practically com- 
pensate the negative effect of preparation noise, which other- 
wise would be destructive for the transmission. The positive 
effect of purification is preserved also in the conditions of re- 
alistic key reconciliation with nonunity efficiency. While pu- 
rification by attenuation is already being used to reduce the 
modulation noise and optimize the modulation for the given 
reconciliation efficiency, the more advanced methods out of 
the scope of linear operations, in particular, feedback control 
of the modulated signals, can be even more effective and may 
be the subject for further research. 
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